Procmon64[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

Procmon64.exe
Size

1.2MB
MD5

69b7dd13214696ed69c1301781caa0dc
SHA1

dbb6cdb47f88aab18fda1a18ab6b618a7cdd44d4
SHA256

010511b641704ccff45ce9987f81b4469211910b92e4a9359529cf078ff98727
SHA512

2791f5d76bdb192f92d9a25a90e3985f2d0777bae6fcd156f454cf242555208a9ab5a96a4573b4f79c3052ebefc33d206b12243d1f03be1af5a72379fa9ec9de
SSDEEP

24576:mzHtB8wapfyqQjsRnf/wasBH/1Qijm7C6P7aorThQZy:mzHt+NyqQwRnXqQijmOquy

Score

1^/10

Malware Config

Signatures

Files

Procmon64.exe
.exe windows x64

41d9f5a1572632cacb728a501c08eb69

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:12:e6:32:c7:b1:8a:02:9a:3a:1f:ac:80:3a:b8:9f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

04/03/2010, 00:00

Not After

18/04/2013, 23:59

Subject

CN=Sysinternals,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Headquarters,O=Sysinternals,L=Austin,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

57:06:99:26:f9:90:f4:81:56:f6:4b:c7:7c:54:91:82:1b:f5:da:43
Signer

Actual PE Digest

57:06:99:26:f9:90:f4:81:56:f6:4b:c7:7c:54:91:82:1b:f5:da:43

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Sysinternals,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Headquarters,O=Sysinternals,L=Austin,ST=Texas,C=US

06/04/2012, 19:20
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ws2_32

accept
bind
gethostbyname
closesocket
recv
getsockname
listen
htonl
WSASetLastError
getservbyport
gethostbyaddr
getservbyname
htons
inet_ntoa
inet_addr
WSAStartup
ntohs
WSAGetLastError
send
connect
socket

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

comctl32

ImageList_SetBkColor
ImageList_Create
ord17
ImageList_Add
ImageList_GetIconSize
ImageList_GetIcon
ImageList_SetOverlayImage
CreateToolbarEx
CreateStatusWindowW
InitCommonControlsEx
ImageList_DrawEx
ImageList_Destroy
ImageList_ReplaceIcon

fltlib

FilterGetMessage
FilterReplyMessage
FilterConnectCommunicationPort
FilterSendMessage

kernel32

CreateFileMappingW
MapViewOfFile
SetEndOfFile
SetFilePointer
GetFileSize
CreateFileW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetVersion
WriteFile
ReadFile
FormatMessageW
LocalFileTimeToFileTime
SystemTimeToFileTime
GetNumberFormatW
GetTimeFormatW
GetDateFormatW
SetThreadPriority
GetCurrentThread
HeapSize
HeapAlloc
HeapFree
WaitForMultipleObjects
CreateEventW
GetComputerNameA
QueryPerformanceFrequency
QueryPerformanceCounter
HeapCreate
CreateSemaphoreW
HeapDestroy
ResetEvent
SetEvent
ReleaseSemaphore
UnmapViewOfFile
GetFileAttributesExW
SetProcessShutdownParameters
SetConsoleCtrlHandler
GetComputerNameW
OpenThread
GetThreadContext
GetCurrentProcessId
LoadLibraryA
GetSystemDirectoryA
FindClose
FindNextFileW
FindFirstFileW
IsWow64Process
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsA
GetStdHandle
HeapSetInformation
FlsAlloc
FlsFree
FlsSetValue
FlsGetValue
DecodePointer
EncodePointer
GetStartupInfoA
GetCommandLineA
GetCurrentThreadId
ExitThread
HeapReAlloc
RtlPcToFileHeader
RaiseException
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlUnwindEx
RtlLookupFunctionEntry
GetProcessHeap
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
TryEnterCriticalSection
GlobalAlloc
GlobalLock
GlobalUnlock
GetLocaleInfoW
CompareStringW
OpenProcess
CreateProcessW
LoadLibraryExW
EnumResourceNamesW
GlobalAddAtomW
FreeLibrary
MulDiv
GetFileAttributesW
GetFullPathNameW
GetSystemInfo
GlobalMemoryStatusEx
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
LCMapStringA
GetVersionExW
VirtualFree
GetCommandLineW
LocalAlloc
LocalFree
DeleteFileW
GetSystemDirectoryW
GetCurrentDirectoryW
ExpandEnvironmentStringsW
SetLastError
FindResourceW
LoadResource
SizeofResource
LockResource
SetFileAttributesW
GetCurrentProcess
GetLastError
VirtualAlloc
DeleteCriticalSection
InitializeCriticalSection
CreateThread
GetTickCount
GetSystemTimeAsFileTime
WaitForSingleObject
CloseHandle
Sleep
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameW
GetModuleHandleW
LoadLibraryW
GetProcAddress
GetModuleFileNameA
GetCPInfo
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
ExitProcess
GetACP

user32

DispatchMessageW
RegisterClassW
LoadBitmapW
DestroyMenu
PostQuitMessage
KillTimer
EqualRect
FlashWindowEx
IsWindowEnabled
LoadMenuW
TrackPopupMenu
IsWindowVisible
SetActiveWindow
SetWindowTextA
DeleteMenu
InsertMenuW
CreateDialogParamW
MessageBeep
IsZoomed
DrawFrameControl
EnableMenuItem
SetMenuInfo
GetDlgItemTextW
SetMenuDefaultItem
CreatePopupMenu
InsertMenuItemW
GetSubMenu
GetMenuItemCount
GetMenuItemInfoW
GetMenu
CheckMenuItem
GetDlgItemInt
SetDlgItemInt
RegisterWindowMessageW
CheckRadioButton
SetWindowPlacement
GetWindowPlacement
BeginDeferWindowPos
EnumChildWindows
EndDeferWindowPos
UnionRect
GetClassNameW
DeferWindowPos
ScreenToClient
GetActiveWindow
GetWindow
GetShellWindow
TranslateMessage
EmptyClipboard
SetClipboardData
CloseClipboard
ClientToScreen
LoadImageW
FindWindowW
WaitForInputIdle
IsIconic
SetForegroundWindow
FindWindowExW
SetFocus
CreateIconFromResourceEx
GetCursorPos
PtInRect
IntersectRect
SetPropW
GetPropW
DestroyWindow
SetClassLongW
DestroyIcon
LoadIconW
SetWindowPos
CallWindowProcW
IsDialogMessageW
TranslateAcceleratorW
GetMessageW
LoadAcceleratorsW
ScrollWindowEx
SetScrollInfo
WindowFromPoint
GetWindowDC
GetKeyState
GetUpdateRgn
OffsetRect
GetCursor
MonitorFromPoint
GetMonitorInfoW
GetFocus
DrawIconEx
FrameRect
IsDlgButtonChecked
CheckDlgButton
GetIconInfo
FillRect
PostMessageW
LoadStringW
DialogBoxIndirectParamW
SetCursor
InflateRect
MessageBoxW
GetDC
ReleaseDC
GetSystemMetrics
GetAncestor
DialogBoxParamW
UpdateWindow
SetWindowLongW
SetWindowTextW
OpenClipboard
GetClassLongPtrW
SetTimer
GetDesktopWindow
EnableWindow
GetDlgItem
MoveWindow
SetDlgItemTextW
EndDialog
LoadCursorW
RegisterClassExW
SendMessageW
ShowWindow
GetWindowRect
GetParent
MapWindowPoints
CreateWindowExW
GetWindowLongPtrW
ChildWindowFromPoint
SetCapture
ReleaseCapture
InvalidateRect
BeginPaint
GetClientRect
GetWindowLongW
GetWindowTextW
GetSysColorBrush
GetSysColor
DrawTextW
EndPaint
SetWindowLongPtrW
DefWindowProcW
GetCapture
GetScrollInfo
GetWindowThreadProcessId

gdi32

SaveDC
SetROP2
Rectangle
RestoreDC
CreateRectRgn
RectInRegion
GetStockObject
CreateRectRgnIndirect
SelectClipRgn
GetBkMode
GetTextMetricsW
GdiFlush
CreateFontW
GetPixel
SetPixel
CreateCompatibleBitmap
CreatePen
Polygon
MoveToEx
LineTo
SelectObject
SetTextColor
SetBkMode
GetBitmapBits
GetBkColor
CreateSolidBrush
GetDeviceCaps
SetMapMode
StartDocW
StartPage
EndPage
EndDoc
SetBkColor
BitBlt
CreateCompatibleDC
DeleteDC
DeleteObject
GetObjectW
CreateFontIndirectW
Polyline

comdlg32

PrintDlgW
ChooseColorW
GetOpenFileNameW
FindTextW
ChooseFontW
GetSaveFileNameW

advapi32

RegQueryValueExA
RegOpenKeyExA
RegEnumValueW
ConvertStringSidToSidW
GetLengthSid
LookupAccountSidW
RegCreateKeyExW
RegSetValueW
MapGenericMask
DuplicateTokenEx
AllocateAndInitializeSid
GetTokenInformation
EqualSid
FreeSid
RegOpenKeyExW
RegEnumKeyW
ConvertSidToStringSidW
RegDeleteKeyW
RegDeleteValueW
RegOpenKeyW
RegQueryValueExW
RegSetValueExW
RegCreateKeyW
RegCloseKey
LookupPrivilegeValueW
OpenProcessToken
AdjustTokenPrivileges

shell32

SHGetMalloc
SHGetPathFromIDListW
CommandLineToArgvW
DragQueryFileW
SHChangeNotify
ShellExecuteW
SHGetSpecialFolderLocation
SHBrowseForFolderW
ShellExecuteExW
SHGetFileInfoW

ole32

CoSetProxyBlanket
CoCreateInstance
CoInitialize
ReleaseStgMedium
RegisterDragDrop
OleInitialize
CreateBindCtx

oleaut32

SysAllocString
SysFreeString
SysStringLen
SysAllocStringByteLen
VariantClear
VariantInit
SafeArrayGetElement
VariantChangeType
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
VariantTimeToSystemTime
SysAllocStringLen

shlwapi

SHAutoComplete

Sections

.text
Size: 754KB - Virtual size: 753KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 249KB - Virtual size: 249KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 157KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

41d9f5a1572632cacb728a501c08eb69

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:12:e6:32:c7:b1:8a:02:9a:3a:1f:ac:80:3a:b8:9fCertificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

57:06:99:26:f9:90:f4:81:56:f6:4b:c7:7c:54:91:82:1b:f5:da:43Signer

Signature Validations

Verification

06/04/2012, 19:20 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

version

comctl32

fltlib

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

Sections

.text Size: 754KB - Virtual size: 753KB

.rdata Size: 249KB - Virtual size: 249KB

.data Size: 8KB - Virtual size: 43KB

.pdata Size: 47KB - Virtual size: 47KB

.rsrc Size: 157KB - Virtual size: 157KB

.reloc Size: 6KB - Virtual size: 5KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:12:e6:32:c7:b1:8a:02:9a:3a:1f:ac:80:3a:b8:9f
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

57:06:99:26:f9:90:f4:81:56:f6:4b:c7:7c:54:91:82:1b:f5:da:43
Signer

06/04/2012, 19:20
Valid: false

.text
Size: 754KB - Virtual size: 753KB

.rdata
Size: 249KB - Virtual size: 249KB

.data
Size: 8KB - Virtual size: 43KB

.pdata
Size: 47KB - Virtual size: 47KB

.rsrc
Size: 157KB - Virtual size: 157KB

.reloc
Size: 6KB - Virtual size: 5KB